I was recently sitting at the Australian Technology Park having a cup of coffee with Casey Ellis, co-founder of Bugcrowd, chatting about upcoming investor presentations. We worked our way on to market sizing, and found that we had both had the same experience when attempting to do a 'bottom up' sizing of the penetration testing market in Australia. The problem that we both came across, was that even using fairly conservative numbers as to the amount companies are spending on penetration testing, the amount of theoretical penetration testing revenue sloshing about in the market simply does not align with the revenue of the service providers in this space, or simply with the number of testers providing these services.
[Incidentally, I had brief flashbacks to my case-study interviews with strategy consulting firms before I started SIFT... where I had awesome questions like:
- "Estimate the size of the market for salmon in the United Kingdom"; and
- "Estimate the number of PCs imported to Australia each year".]
Back to the penetration testing market...
Let's start with the big guys.
ASX 20
Of the ASX20, which includes companies in financial services, materials/mining, energy, consumer staples, telecommunications and healthcare, my back-of-the-envelope estimates would suggest that the biggest spenders would spend about $4 million annually on penetration testing, and the lowest spenders would spend about $100K annually. Putting together the expenditure of the whole group, I estimate it works out at pretty close to a neat $20 million across the 20 companies.
And of course, the ASX20 is - as its name suggests - just the 20 largest companies by market capitalisation on the ASX. There are a total of 2,157 companies listed on the ASX (when I downloaded the list a moment ago), all of whom you could argue have some degree of obligation to their shareholders to ensure the security of their data and systems, with penetration testing being a pretty common response to that obligation. For argument's sake, lets say less than half of them do anything, so 1,000 companies. And let's assume that averaged across that many organisations, the average spend on penetration testing is $50K per annum. That's another $50 million into the annual penetration testing market.
Let's look at some other big-spending sectors where some reasonably neat figures are available (about the size of the sector; if not the amount spent):
Financial Services
I'd estimate that about 60-70% of the ASX20 spend is coming from the financial services companies in the group who were some of earliest adopters of penetration testing as a service, and continue to be the 'anchor tenant' for the industry.
According to APRA, at the end of 2012, there were 19 Australian banks, 8 foreign subsidiary banks, and 40 branches of foreign banks. On top of these, there were 91 credit unions and 9 building societies. There are also a handful of 'miscellaneous' companies like payments clearing, 'specialist credit card institutions' and 'purchased payments facilities' who are also significant market participants.
So that's an extra 170-ish financial services companies who are probably getting penetration testing completed to a greater or lesser extent. Even if we rule out the 'branches of foreign banks' (as many of them will have their penetration testing managed by the global head office and hence delivered from overseas), we've still got about 130. Chop out the group already counted in the ASX20, and we've got about 125. Now let's be super-conservative and say that they will spend only 10% of the amount that the larger companies will spend; or a meager $100K per institution. That's another $12.5 million into the annual penetration testing market.
Take a moment to consider that according to the Australian Bureau of Statistics, at the end of the 2010-11 year, there were over 164,000 businesses in Australia classified as 'financial and insurance services'. In the calculations above we covered about 200 of them; admittedly the biggest, but it still leaves a vast number who have data to protect, and some of whom certainly have some penetration testing done. (If just 2% of them spend just $5K each, that's another $15 million into the budget).
Government
Federal, State and even Local Government are covered by a range of policies explicitly requiring independent penetration testing. One of the most succinct is that of the Victorian Government - SEC STD: Penetration testing which states that:
According to vic.gov.au's Contacts & Services directory, there are 521 distinct entities within the Victorian Government, for which 259 unique URLs are provided. For example, the letter 'A'...
As per policy, each of these needs at least annual independent penetration testing. Let's use our average across the set (covering both infrastructure and applications) of just $20K per annum. That gives us about another $6 million for our penetration testing budget.
To avoid the pain of digging out the numbers for all the other states and territories, let's make a broad assumption that all the other state and territory governments added together, sum to three times the size of Victoria's, in terms of Internet-facing infrastructure (which given it include NSW & QLD, plus the rest, seems reasonable). Let's also assume that they have a similar intent to test everything annually. So that's another $18 million to the budget. That number feels high, so let's include all local government, councils etc across the country as well in that figure.
And of course there is also Federal Government. It's possible to download a list of all registered contracts with keywords like 'penetration testing' or 'security testing' at https://www.tenders.gov.au/?event=public.CN.search, but these lists are woefully incomplete when trying to get a picture of the size of the market. The Federal Government side of things is also somewhat obscured by the fact that at least some of the vulnerability assessment and penetration testing completed is performed by the Defence Signals Directorate (DSD). Rather than tie myself in knots trying to work it through, I'll take a short-cut and assume it's the same as Victoria: $6 million annually, across all government agencies including the Defence Department.
E-Commerce / Payments
The Payment Card Industry Data Security Standard (PCI DSS) requires penetration to be completed at least annually for in-scope systems and organisations.
There are approximately 200,000 websites in the .au domain space with 'shopping cart' functions. Mmany of those will be using PCI compliant externally-hosted shopping carts so probably don't get penetration testing completed themselves. But let's say just 10% of e-commerce websites with 'shopping cart' functions get penetration tested each year. That's 20,000 websites. Most of these are probably pretty small, so let's say they are just $10K penetration tests. That's another $20 million in the budget.
We'll assume that the vast number of companies covered by PCI DSS, but who don't have a distinct 'shopping cart' function so aren't included in the figures above, are covered elsewhere in one of the figures we've already looked at.
Education
There are 44 universities in Australia, and another half-a-dozen miscellaneous self-accrediting higher education institutions (ie theological colleges, maritime college etc), giving us a nice neat 50.
There are then at least another 100 state and territory accredited educational organisations, plus TAFEs and the like. There are thousands of schools.
Given universities'... errr... 'creative' student population, they have a bigger need than most of the others here. Let's assume $100K per annum for the universities, which is $5 million in total to the budget.
For the thousands of schools, TAFEs, and other miscellaneous bodies, it's hard to know where to start, so let's just allocate the entire sector $25 million and be done with it. If there are 5,000 schools across the country that's only $5K of testing per school, so pretty conservative, although I'm cognisant of the fact that far-flung country-shed classrooms are unlikely to be having this testing done.
Information & Communications Technology (inc Software)
One of the larger consumers of penetration testing services is the broad and large ICT industry - and in this I also include companies developing software for sale to others, who therefore have a requirement for security assurance of that product prior to taking it to market. It is also the fourth largest industry sector contributing to Australian GDP and employs 291,000 people in Australia. According to the Australian Bureau of Statistics, at the end of the 2010-11 year, there were 18,854 businesses operating in the Information, Media & Technology classification.
Let's just say 1% of these companies, spend $100K annually on penetration testing. That's close enough to another $20 million.
The rest
And we haven't even touched industry sectors like healthcare, resources (in the midst of all the 'China APT' news), legal, accounting, professional services, let alone the hundreds of thousands of small and medium sized businesses in this country, at least some of whom are spending some money on penetration testing.
Adding it all up
So using this logic, there's a spend of something like $200-300 million on penetration testing, annually, in Australia. Given the massive slabs of Australian business that are not covered in the figures above, even with the odd wayward assumption or double counting here and there, it seems reasonable.
And this is where the trouble starts. Where is it going?
Many jurisdictions have bodies similar to the ACCC who are responsible for monitoring the misuse of market power. In some of these jurisdictions, they have put numbers to what 'substantial market power' means, and a 'minimum' threshhold for considering a company to have an influential market position. The best figures I could find are from Hong Kong, who discuss using 40% as an indicator of 'substantial market power', and 25% as the 'minimum' threshhold before being particularly interested in a company's market position. Working with these:
- Taking the 40% figure, we'd be looking for a company with $80-120 million in penetration testing revenue, annually, in Australia. They don't exist. No big deal, it just means we don't have a company with 'substantial market power'.
- Taking the 25% figure, we'd be looking for a company with $50-75 million in penetration testing revenue, annually, in Australia. They still don't exist. So we don't have any real competition concerns in the market, which is healthy.
- For argument's sake, let's take a 10% figure, so we'd be looking for a company with $20-30 million in penetration testing revenue, annually, in Australia. I'm still doubtful any service provider in Australia operates at that level.
If I'm right, and there is not a single company in Australia with 10% of the penetration testing market, who is delivering all these penetration tests? Or is it that the numbers above are fundamentally incorrect because organisations just don't do as much penetration testing as they should (under policy, regulation, best practice etc)?
Let's take another angle on this. Using $200 million as the market size, and a pretty standard average consulting rate of $1,500/day, there are about 133,333 days worth of consulting-level penetration testing to be delivered each year, which would require about 610 full time penetration testers in service provider organisations. They aren't there either.
One thing I am confident of is that there is also an extremely long tail when it comes to suppliers of these services. That is, there is a very large set of companies who each provide a very low portion of the services overall consumed in the market. A great many miscellaneous ICT service providers (of which as per above there are many thousands) provide security related services such as penetration testing to their existing client base, with varying levels of quality. Because of the large numbers, if 1,000 of these companies provide $100K of penetration testing services each, that could make up $100 million of the market total.
Another interesting question is how big the market would be if everyone was following 'best practice'. At present, there is far from anything like consistency when it comes to the amount that organisations are spending on IT security, let alone on a sub-set of the topic such as penetration testing. Near-identical banks can quite plausibly be spending amounts on penetration testing that are out by a factor of 10. Where one bank spends $2 million; another spends $200,000. There are also a great many companies - including those no doubt in lists like the ASX 200 - who simply do not have penetration testing completed at any meaningful level.
If all Government agencies were following policies and had every system tested annually; and all PCI-relevant organisations had penetration testing completed annually; and all ICT companies had their software and hardware tested before releasing it to market... etc, then the figures above could easily double to $500 million plus, annually.
So we have a $200-300 million market (much of which is probably only now coming to market for the first time), with a half-billion dollar opportunity, with no company in a position of market dominance, and an under-supply of qualified penetration testers to deliver the services.
Pretty compelling. Want to buy a penetration testing company? Call me.